> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# UNC6993 exploits LLM API keys for $100K daily theft
- URL: https://f4n6.co.uk/security-feed/unc6993-exploits-llm-api-keys-for-100k-daily-theft/
- Published: 2026-11-02T16:54:51.000Z
- Updated: 2026-11-02T16:54:51.000Z
- Author: Jeff Davies
- Tags: #security-feed, UNC6993

## 1\. Executive summary

Mandiant incident responders documented multiple 2026 intrusions in which financially motivated actors hijacked enterprise access to large language models, a tactic Google calls LLMJacking, with fraudulent resource-consumption charges exceeding $100,000 USD in a single day and cumulative charges at some victims reaching $1 million USD before access was revoked. The victims span North America, South America and Asia Pacific across financial services, retail, technology and transportation. One cluster Google tracks as UNC6993 gained access to LLM API keys, generated additional keys, enabled services in the victim's cloud projects and ran up $100,000 in charges; in a separate Mandiant case it compromised a cloud instance through a misconfigured Service Account key and used a session-hijacking page to capture active access tokens past password and MFA controls. No CVE is associated with this activity and no CISA KEV entry applies. The risk to EMEA financial services is financial and operational rather than destructive: exposed or stolen cloud identity tokens (IAM credentials, Service Account keys, GitHub Personal Access Tokens, active session tokens) let an intruder bill model inference to the victim while staying anonymous, and the same stolen capacity feeds downstream resale services. UNC6993 has no MITRE ATT&CK profile, so the attribution is unconfirmed.

## 2\. Regulatory framing

| Article                                                                 | Trigger (the fact in this item)                                                                                                                                                                    | Practical impact                                                                                                                                                            |
| ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk — general principles                 | Intrusions arrive through cloud identity tokens and model API access held under the client's contracts with cloud and LLM providers, and the fraudulent charges accrue on those provider accounts. | Third-party risk assessment must cover who holds API keys and service account credentials for cloud and model providers, and how those credentials are rotated and revoked. |
| DORA Art. 30: key contractual provisions with ICT third-party providers | The loss is measured in provider-billed token consumption, so detection and revocation depend on what the provider's billing and audit interfaces expose to the client.                            | Contract terms should give the client access to billing anomaly data and the ability to revoke keys and service accounts on demand.                                         |
| NIS2 Art. 21(2)(d): supply chain security measures                      | The dominant initial access vector is stolen cloud identity tokens, including GitHub Personal Access Tokens used to reach private code repositories.                                               | Supply chain security measures must extend to developer credentials and secrets in code repositories, not only to supplier software.                                        |

## 3\. Technical analysis & attack chain

LLMJacking targets backend model resources directly rather than front-end chat interfaces. The actor either finds a publicly exposed LLM endpoint or obtains a valid LLM API key, then runs inference on the victim's account. Google describes an automated script that verifies exposure by calling the `/api/create` endpoint to run the actor's own models on endpoints users have left publicly accessible.

The confirmed steps in the UNC6993 cases Mandiant responded to:

1. Initial access through a misconfigured Service Account key, which gave the actor a foothold in a cloud instance.
2. Use of that access to grant further access to a model API.
3. Generation of additional API keys and enabling of services within the victim's cloud projects, producing $100,000 in charges in the case Google details.
4. In a parallel case, hosting of a session-hijacking page masquerading as an application portal for a group of LLM users. The page sends users to the legitimate LLM service website and asks them to paste their raw JSON payload containing an active access token; the token is posted to the backend API, which bypasses password and MFA controls.

Google reports the dominant initial access vector across its LLMJacking investigations is exposed or stolen cloud identity tokens: IAM credentials, Service Account keys, GitHub Personal Access Tokens and active session tokens. In one instance an actor combined a stolen PAT giving access to private code repositories with exploitation of a suspected web application vulnerability in a package running within a container. The source text is truncated at that point and does not name the package, the vulnerability or a CVE.

A second pattern in the reporting involves subscription abuse rather than key theft. An actor subscribed victim accounts to Pay-As-You-Go agreements to reach advanced models at the victim's expense, selected premium foundation models, launched high-volume inference streams, and used a "burn and rotate strategy" to bypass rate limits by creating and deleting short-lived service accounts while monitoring the billing interface to track the financial impact.

Monetization runs through what Google calls LLM Mixers: illicit routing gateways that proxy, aggregate and resell unauthorized LLM access to underground subscribers. In one investigation GTIG observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure. A token routing service called Jet Night executed more than 500,000 LLM API calls in under eight hours using stolen third-party API keys, according to Google's 2 November report. Jet Night offers an unlimited token plan for approximately $60 USD per month with alleged access to frontier models, against a typical consumer cost of $100 to $250 per month; GTIG assesses the service relies on stolen keys to operate profitably. Jet Night has acknowledged multiple outages on its public Telegram channel, which Google says are likely caused by victims revoking stolen keys.

The impact is billing and resource consumption. Google contrasts LLMJacking with cryptojacking: where cryptojacking consumes resources gradually, LLMJacking can produce large spikes in fraudulent cloud charges within hours. No data theft, ransomware or destructive action is reported in these incidents.

Attribution caveat: UNC6993 is a Google tracking designation. It has no MITRE ATT&CK profile, and no source in this item links it to a named nation-state or established threat group. Treat the attribution as unconfirmed. The technical detail above rests on Google's and Mandiant's reporting; the Jet Night volume figure and the $60 monthly pricing are single-sourced to Google.

## 4\. Mitigation & containment

P1 within 24h

- Inventory every LLM API key, cloud IAM credential, Service Account key, GitHub Personal Access Token and active session token your organisation holds, and revoke any that cannot be tied to a current owner and workload. Google names exposed or stolen cloud identity tokens as the dominant initial access vector.
- Search cloud billing and audit logs for new API keys created, services enabled, or Pay-As-You-Go subscriptions added on model and cloud accounts, and for short-lived service accounts being created and deleted in sequence. These are the actions Google reports in the UNC6993 and subscription-abuse cases.
- Block user submission of raw JSON access-token payloads to any portal that redirects to an LLM provider login. The session-hijacking page in this item relies on users pasting an active token; no legitimate provider flow requires it.

P2 within 72h

- Move API keys and secrets into a centralised secrets management platform and rotate them on a schedule, which is Google's stated recommendation.
- Apply least-access privileges to users and service accounts so each holds only the permissions its role needs.
- Automate secrets scanning in codebases to find and remove API keys and secrets committed to source code, the control that addresses the stolen-PAT path.
- Restrict network reachability of self-hosted model servers, AI gateways and internal test systems so they are not publicly exposed, and check for endpoints answering `/api/create`.

P3 within 7 days

- Add billing-anomaly alerting on token consumption and model API spend, with a threshold that fires on hourly spikes rather than monthly totals.
- Review cloud and LLM provider contracts for the client's right to billing anomaly data and immediate key revocation, per the third-party provisions in §2.

No vendor fix or patch is named in public reporting for this activity; it is abuse of valid credentials and exposed endpoints, not exploitation of a scored vulnerability. No CVE is associated with this item.

## 5\. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IP addresses, file paths) are given in the source material for this activity. The sources describe behaviours and one endpoint path only.

| type | value | confidence | source |
| ---- | ----- | ---------- | ------ |
| n/a  | n/a   | n/a        | n/a    |

Behavioural indicators

| behaviour                                                                                    | where to observe                                              | confidence                                  |
| -------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------------------------------- |
| Automated calls to /api/create to run actor-controlled models on exposed endpoints           | HTTP access logs on self-hosted model servers and AI gateways | Medium (single source, Google)              |
| New API keys generated and services enabled in victim cloud projects                         | Cloud provider audit logs and IAM key-creation events         | High (reported in the UNC6993 case)         |
| Pay-As-You-Go subscription added to a model account, followed by high-volume inference       | Provider billing console and subscription change logs         | Medium (single source, Google)              |
| Short-lived service accounts created and deleted in sequence to evade rate limits            | Cloud IAM and audit logs                                      | Medium (single source, Google)              |
| Users pasting raw JSON access-token payloads into a portal that redirects to an LLM provider | Web proxy, browser and endpoint telemetry                     | Medium (single source, Google)              |
| Large hourly spikes in token consumption and model API spend                                 | Cloud and LLM provider billing data                           | High (consistent across reported incidents) |

## 6\. Detection

The sources give no file artefacts, command lines, mutexes or registry keys for this activity, so a YARA rule would have nothing genuine to match. Detection rests on the behavioural patterns above. The Sigma rule below targets the cloud audit behaviours Google describes; field names vary by provider and must be mapped to your schema before deployment.

```yaml
title: LLMJacking credential and billing abuse
id: 8f3c2a71-4b6e-4d2a-9c1f-llmjack00001
status: experimental
description: Detects cloud audit behaviours associated with LLMJacking, including service account key creation, short-lived service account churn and model API subscription changes.
author: Adverse Trace
date: 2026/11/02
references:

  - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/
logsource:
  product: cloud
  service: audit
detection:
  key_creation:
    eventName:

      - CreateServiceAccountKey
      - CreateAccessKey
  subscription_change:
    eventName:

      - UpdateBillingInfo
      - CreateSubscription
  service_account_churn:
    eventName:

      - CreateServiceAccount
      - DeleteServiceAccount
  condition: key_creation or subscription_change or service_account_churn
falsepositives:

  - Legitimate automation that provisions and removes service accounts
  - Approved billing or subscription changes by finance or platform teams
level: medium

```

## 7\. Sources

- Google TAG / Mandiant, "The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources", https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/
- The Register, "Token thieves costing companies $100K+ per day in illicit LLM charges", https://www.theregister.com/security/2026/11/02/token-thieves-costing-companies-100k-per-day-in-illicit-llm-charges/5306967, 2026-11-02
- Palo Alto Unit 42, "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources", https://unit42.paloaltonetworks.com/ai-token-jacking/ (separate reporting on the same LLMJacking ecosystem; no event-specific facts used here)
- Help Net Security, "Hackers hijack exposed AI models to launch cyberattacks at victims' expense", https://www.helpnetsecurity.com/2026/10/23/llmjacking-agent-hijacks-exposed-ai-models/, 2026-10-23 (separate Symantec honeypot research on an autonomous LLMjacking agent; not the UNC6993 event)

## 8\. Adverse Trace position

Adverse Trace assesses this as a high-impact financial and operational risk for EMEA financial services clients that hold cloud or LLM provider accounts, driven by billing loss and credential exposure rather than data compromise; no CVE, CVSS score or CISA KEV entry applies, and the UNC6993 attribution is unconfirmed because the cluster has no MITRE ATT&CK profile. The $100,000 daily and $1 million cumulative figures come from Google's and Mandiant's incident response work and should be treated as reported, not independently verified; the Jet Night volume and pricing are single-sourced to Google. We will track further reporting on LLMJacking monetization infrastructure and on UNC6993, and will issue an update if a source names the suspected web application vulnerability referenced in the truncated Google text or links the cluster to an established actor. Clients should treat exposed cloud identity tokens and model API keys as the priority control gap this week.

---

[Read the original source →](https://www.theregister.com/security/2026/11/02/token-thieves-costing-companies-100k-per-day-in-illicit-llm-charges/5306967?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*